How Gmail access works

Permission requested

Unsubscriber requests only https://www.googleapis.com/auth/gmail.readonly. This permission lets the protected backend read messages and settings, but it does not allow Unsubscriber to send, modify, label, move, or delete email.

Why this permission is needed

Subscription receipts and lifecycle notices use many providers, senders, subjects, and body formats. Gmail's narrower metadata access cannot provide the message-body evidence needed to identify the service, exact renewal or expiry date, amount, or confirmed cancellation. Unsubscriber therefore uses read-only access and applies its own subscription-evidence filters.

Gmail capacity

Normal and trial access use the primary sign-in Gmail. Pro includes three Gmail accounts and can add up to ten more, for thirteen total. If paid capacity is reduced, the user chooses the dashboards that remain active. Other connected dashboards retain their saved records in read-only mode and stop background processing after the current paid period.

What the app does

1. You explicitly accept the in-app Gmail AI disclosure, choose Connect Gmail, and approve Google's consent screen.
2. The initial search checks subscription-related candidates received within the previous one calendar year. It follows all result pages, including more than 300 candidates, with no total message-count cutoff.
3. After that, Gmail mailbox-change notifications trigger incremental processing of newly added messages through the same keyword and received-date gates.
4. Payment-method-only notices create no dashboard card; the user may import a screenshot when needed.
5. Fixed parsers extract exact facts first. Only credible provider and subscription candidates that need more extraction may send a short sanitized billing excerpt to the paid Gemini API after the current consent disclosure.
6. Only extracted subscription fields and a short evidence line are saved to the selected Gmail dashboard.

AI safeguards

• AI runs only after deterministic filtering and cannot be started by Refresh.
• Deterministic extraction runs first, including known providers.
• The limited excerpt may include plan, amounts and dates. Email addresses, card references, greeting names and links are redacted where detected; full bodies and attachments are not retained.
• AI results require exact evidence and provider association. Uncertain or ambiguous legacy records remain available for review in Settings.
• Account/message requests are idempotent. Gmail AI is capped at 5 attempts per Firebase user per UTC month across all linked accounts; the project safety cap is 5,000 attempts.

What the app does not do

• It does not store full email bodies or attachments.
• It does not send, modify, label, move, or delete email.
• It does not use Gmail data for advertising, credit decisions, surveillance, or sale.
• It does not use Gmail data to train generalized or personalized AI models.

Control and deletion

You can disconnect any Gmail in Settings, revoke access from your Google Account, or delete your Unsubscriber account. Disconnecting revokes that account's stored token. Account deletion permanently removes all encrypted credentials, Gmail mappings and scan markers, and synced Unsubscriber account data.

Disaster recovery copies

Operational database backups are configured for daily recovery with a seven-day retention policy, and point-in-time recovery retains up to seven days of available history after enablement. Existing recovery copies may retain deleted account data, including encrypted credentials and subscription metadata, until their configured retention expires. Access is restricted to authorized administrators for recovery purposes. Deleted accounts are not intentionally reactivated from backups. Active account deletion removes live application records as described above.